pix token certificado oauth2

Estou fazendo a requisição para pegar o token pelo endpoint https://secure.sandbox.api.pagseguro.com/pix/oauth2 e está me retornando: {"message":"Forbidden"}.

Eu consigo estabelecer a conexão (com o servidor através do certificado e das credenciais de autenticação (client id e client secret) por Basic Auth.

O log detalhado da aplicação é o seguinte:

Starting handshake
Secure session established
negotiated protocol: TLSv1.2
negotiated cipher suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
peer principal: CN=secure.sandbox.api.pagseguro.com
peer alternative names: [secure.sandbox.api.pagseguro.com]
issuer principal: CN=Amazon, OU=Server CA 1B, O=Amazon, C=US
Connection established 10.0.1.4:55875<->54.146.47.24:443
Executing request POST /pix/oauth2 HTTP/1.1
Proxy auth state: UNCHALLENGED
http-outgoing-0 >> POST /pix/oauth2 HTTP/1.1
http-outgoing-0 >> Accept: /
http-outgoing-0 >> Host: secure.sandbox.api.pagseguro.com
http-outgoing-0 >> Content-Type: application/json
http-outgoing-0 >> Connection: keep-alive
http-outgoing-0 >> Authorization: Basic ...
http-outgoing-0 >> Content-Length: 153
http-outgoing-0 >> User-Agent: Apache-HttpClient/4.5.9 (Java/1.8.0_191)
http-outgoing-0 >> Accept-Encoding: gzip,deflate
http-outgoing-0 >> "POST /pix/oauth2 HTTP/1.1[\r][\n]"
http-outgoing-0 >> "Accept: /[\r][\n]"
http-outgoing-0 >> "Host: secure.sandbox.api.pagseguro.com[\r][\n]"
http-outgoing-0 >> "Content-Type: application/json[\r][\n]"
http-outgoing-0 >> "Connection: keep-alive[\r][\n]"
http-outgoing-0 >> "Authorization: Basic ...[\r][\n]"
http-outgoing-0 >> "Content-Length: 153[\r][\n]"
http-outgoing-0 >> "User-Agent: Apache-HttpClient/4.5.9 (Java/1.8.0_191)[\r][\n]"
http-outgoing-0 >> "Accept-Encoding: gzip,deflate[\r][\n]"
http-outgoing-0 >> "[\r][\n]"
http-outgoing-0 >> "{"grant_type":"client_credentials","scope":"pix.write pix.read"}"
http-outgoing-0 << "HTTP/1.1 403 Forbidden[\r][\n]"
http-outgoing-0 << "x-amzn-RequestId: ...[\r][\n]"
http-outgoing-0 << "x-amzn-ErrorType: ForbiddenException[\r][\n]"
http-outgoing-0 << "x-amz-apigw-id: ...[\r][\n]"
http-outgoing-0 << "content-type: application/json[\r][\n]"
http-outgoing-0 << "content-length: 23[\r][\n]"
http-outgoing-0 << "date: Thu, 17 Nov 2022 18:51:23 GMT[\r][\n]"
http-outgoing-0 << "[\r][\n]"
http-outgoing-0 << "{"message":"Forbidden"}"
http-outgoing-0 << HTTP/1.1 403 Forbidden
http-outgoing-0 << x-amzn-RequestId: ...
http-outgoing-0 << x-amzn-ErrorType: ForbiddenException
http-outgoing-0 << x-amz-apigw-id: ...
http-outgoing-0 << content-type: application/json
http-outgoing-0 << content-length: 23
http-outgoing-0 << date: Thu, 17 Nov 2022 18:51:23 GMT
Connection can be kept alive indefinitely
Response 403 FORBIDDEN

Alguém tem ideia do que pode estar dando errado?
Um detalhe: eu consigo fazer essa requisição via postman sem problema algum e eu não consegui reproduzir esse erro "{"message":"Forbidden"}" no postman.